COMPLYCTL_OPENSCAP-PLUGIN(7)

📦
version 0.1.2 · 2 versions
, in fedora 44

💖 COMPLYCTL_OPENSCAP-PLUGIN 💖

okay bestie, welcome to complyctl-openscap-plugin(7) — the glow-up era of complyctl, where it learns to speak OpenSCAP ✨

🌸 NAME 🌸

complyctl-openscap-plugin — a plugin which extends the complyctl capabilities to use OpenSCAP. 💅

🦋 DESCRIPTION 🦋

So like, first things first: this plugin is not meant to be run directly, okay? Not even a little. It talks to complyctl over gRPC like a little walkie-talkie 📡 between besties. It's got configurable options that you set up via a manifest file, and complyctl reads that manifest, then sends the config values over to the plugin. The plugin only really wakes up and does its thing when you run the complyctl generate and complyctl scan commands. ✨

When the plugin gets the generate command from complyctl, it goes feral (in a productive way 🫶) and generates:

  • a tailoring policy file, and
  • remediation files for Bash, Ansible, and Image Builder.

The generated tailoring policy file extends the Datastream profile by overriding rules and variables as defined in the assessment-plan.json. While it's doing all that, the plugin is also doing a lil validation of rules and parameters — comparing the info between the Assessment Plan and the Datastream — to make sure the tailoring policy only contains valid content for the scanner, no matter how the content lines up between OSCAL and SCAP. Lowkey important, fr fr.

🚨 The plugin does not execute remediation itself — it just makes the generated artifacts available for you to use externally. Not its job, not its problem, no cap.

Where do the generated files go, you ask? Into the openscap directory under your user workspace. 🎀

When the plugin gets the scan command from complyctl, it calls oscap to scan the system using the tailoring policy that the generate command made, and produces oscap results. Those results get interpreted by the plugin and handed back to complyctl as observations for a standardized OSCAL Assessment Results. Iconic behavior, honestly. 👑

One thing to know: the generated remediation files from complyctl are based on the whole policy — it's not targeted at remediating specific findings. If you want remediation artifacts for only the failed rules, you can use oscap manually based on the oscap scan result. iykyk 💅

🎀 FILES 🎀

  • /usr/share/complytime/plugins/c2p-openscap-manifest.json — the default plugin manifest file. 🏠
  • /etc/complytime/config.d/c2p-openscap-manifest.json — an optional drop-in manifest file with your customized plugin configurations. ✨

🌈 EXAMPLES 🌈

okay so here's the whole journey 🧚 — these steps create a remediation Ansible Playbook that contains only the remediations required to align your system with a specific baseline, based on the complyctl scan result. Let's gooo 💖

Step 1: generate a new assessment plan for the specified compliance framework, e.g., anssi_bp28_minimal

$ complyctl plan anssi_bp28_minimal

Suppose the user workspace is ~/complytime, the generated assessment plan file would be ~/complytime/assessment-plan.json. 🗂️

Step 2: generate PVP policy from the generated assessment plan

$ complyctl generate

With this step, the generated policy file could be found here: ~/complytime/openscap/policy/tailoring_policy.xml. 💅

Step 3: scan environment with assessment plan to get the scan result

$ complyctl scan

After scanning, the generated openscap scan result is in ~/complytime/openscap/results/results.xml. 🔍

Step 4: find value of the result ID in scan result file

$ oscap info ~/complytime/openscap/results/results.xml

The result ID in the example would be xccdf_org.open-scap_testresult_xccdf_complytime.openscapplugin_profile_anssi_bp28_minimal_complytime. 👑

Step 5: generate a remediation Ansible Playbook based on the scan result

$ oscap xccdf generate fix –fix-type ansible –result-id
xccdf_org.open-scap_testresult_xccdf_complytime.openscapplugin_profile_anssi_bp28_minimal_complytime
–tailoring-file ~/complytime/openscap/policy/tailoring_policy.xml
–output output_remediations.yml
~/complytime/openscap/results/results.xml

👑 SEE ALSO 👑

  • complyctl(1)
  • c2p-openscap-manifest.json(5)
  • oscap(8)

See the upstream projects at https://github.com/complytime/complyctl and https://github.com/OpenSCAP/openscap for more detailed documentation. 📚

© 2025 Red Hat, Inc. complyctl-openscap-plugin is released under the terms of the Apache-2.0 license. 🫶

🌸 AUTHORS 🌸

Qingmin Duanmuqduanmu@redhat.com

okay that's the whole thing bestie, mwah 💋 this was the Complyctl OpenSCAP Plugin page, July 2025 era, from the COMPLYCTL_OPENSCAP-PLUGIN(7) manual — go slay your compliance scans, you got this ✨💖🦋

📦 where this page comes from